Authorization/Scope Mismatch Error When Connecting Hubspot

henrymeiklejohn · October 28, 2024, 11:22pm

I want to connect my Hubspot instance to be able to read/write Contacts and Deals from workflows.

It appears by default that "crm.objects.contacts.read" is the only scope authorized.

I'm able to connect with OAuth successfully using only this scope, but once I add additional scopes I get the following error.

Authorization failed because there is a mismatch between the scopes in the install URL and the app's configured scopes. Please contact the app developer.

This happens if I try to add the scopes before establishing the initial connection, or after establishing the initial connection and using the "Reconnect" option.

Has anyone encountered this before? Do I have to set scopes from the Hubspot side as well? Does that need to be done from a Hubspot Developer account rather than a standard account?

Thanks in advance

wwwhatley · October 31, 2024, 3:59pm

Same here.

Darren · October 31, 2024, 5:10pm

Hi @henrymeiklejohn! And welcome to the community, @wwwhatley.

Generally speaking, OAuth2 apps do need to be configured with specific scopes when set up on the resource side of things. As such, this seems like an issue with the HubSpot integration. I'll talk to the team about a fix!

In the meantime, it's pretty easy to set up OAuth2 for a regular REST API query and to integrate with HubSpot that way! Note that this does require a developer account on HubSpot, though.

Let me know if you have any questions about implementing the above workaround. I'll also keep you updated here.

henrymeiklejohn · October 31, 2024, 7:18pm

Thanks for the suggestion @Darren. I've started the REST API setup with OAuth2 and still running into the same error. Here are the settings I'm trying to figure out on the resource setup:

Settings I feel confident on:

Base URL: https://api.hubspot.com
Authentication: OAuth 2.0-Authorization Code Grant
OAuth callback URL:https://oauth.retool.com/oauth/user/oauthcallback (default)
Access Token URL: https://api.hubapi.com/oauth/v1/token (from Docs)
Client ID: From the app I created
Client Secret: From the app I created

Settings I'm confused on:

Authorization URL: Base is https://app.hubspot.com/oauth/authorize. Not sure If I should add additional query parameters
Scopes:

From my app, Hubspot gives the install URL: https://app.hubspot.com/oauth/authorize?client_id=SANITIZED&redirect_uri=https://oauth.retool.com/oauth/user/oauthcallback&scope=crm.schemas.contacts.write%20oauth%20crm.objects.appointments.read%20crm.objects.appointments.write%20crm.objects.custom.read%20crm.objects.custom.write%20crm.objects.deals.read%20crm.schemas.contacts.read%20crm.objects.deals.write

I've tried using this directly in the Authoeization URL and I get the same error. Not sure if the other query parameters in there are causing issues.

Darren · October 31, 2024, 8:26pm

These are the settings that work for me:

Retool will construct the full URL based on the information you specify here! As far as scopes are concerned, it's important that you specify them both in Retool and in the configuration of the HubSpot app:

Give that a shot and let me know if you still run into any issues!

henrymeiklejohn · October 31, 2024, 10:22pm

Made some progress, I was able to connect the resource, however now when I try to run a query I get this error:

error:"{"status":"error","message":"Authentication credentials not found. This API supports OAuth 2.0 authentication and you can find more details at https://developers.hubspot.com/docs/methods/auth/oauth-overview","correlationId":"00000000-0000-0000-3cbe-c77ad31a020d","category":"INVALID_AUTHENTICATION"}

Darren · October 31, 2024, 10:34pm

In the resource configuration, make sure you add an Authorization header with a value of Bearer OAUTH2_TOKEN. I neglected to include that in my earlier screenshot!

henrymeiklejohn · October 31, 2024, 11:10pm

Thanks, that fixed it, silly oversight on my part.

The REST API resource will work nicely as a temporary (or perhaps permanent) workaround, but I'd definitely like to stay updated for any fixes on the native integration.

Darren · October 31, 2024, 11:12pm

For sure! I'll keep you updated.

Pierce_Cosgrove · November 1, 2024, 3:32pm

I believe I'm getting a similar error. I am trying to create an app for Real Time Updates to a 3rd party dialer (Connex)

Connex has a marketplace item for this to be done, where we enter the client id/secret/other details and then authorize through Hubspot. I am getting the error "Authorization failed because there is a mismatch between the scopes in the install URL and the app's configured scopes. Please contact the app developer."

This is my install URL https://app.hubspot.com/oauth/authorize?client_id=99475399-12a5-471e-aa34-166e3876307d&redirect_uri=https://claim247-cxm.uk.connexone.cloud/integrations/hubspot-app/authorize-workspaces&scope=oauth%20crm.objects.contacts.read

And these are the configured scopes

Unless this is a Hubspot issue, the only thing I can think is that I need to set some of my scopes to be either conditionally required or optional? But not sure why that would be the case.

Darren · November 1, 2024, 6:34pm

Hi @Pierce_Cosgrove! Welcome to the community.

I'm afraid I can't be of much help, as it looks like this is an issue with integrating two non-Retool resources. That said, you're probably right that the root of the issue is a similar one - the scopes listed in the initial authorization request being made from Connex to HubSpot don't match up with the scopes that have been configured.

I hope that gives you some guidance, but will leave this conversation open for anybody else from the community to jump in.

henrymeiklejohn · November 8, 2024, 8:30pm

Hello, revisiting this topic as I'm having difficulty connecting my Hubspot Sandbox account as the Staging Environment for this resource.

After I click "Reconnect with OAuth", I see a screen where I can select which Hubspot account to connect to.

The problem is that whatever selection I make gets applied to both environments (Prod and Staging).

What can I do to have each one connect to the correct account?

Should I create a new app in my Hubspot Developer account (with new client credentials) specifically for the Sandbox?

kramer · November 14, 2024, 8:08pm

Hi @Darren - any update to the scope error when using the native HubSpot integration? Thanks!

Darren · November 19, 2024, 11:55pm

Hey @henrymeiklejohn! Thanks for your patience - I definitely intended to respond here sooner.

In testing, I wasn't able to immediately replicate the behavior that you're describing. Even with the option to Share credentials between users toggled on, Retool successfully tracked a distinct set of auth tokens for each environment.

I took a screen recording of my test here, including the configuration of the REST API resource. Take note of any discrepancies and definitely let me know if you continue to have issues with this!

Darren · November 19, 2024, 11:58pm

No significant updates, unfortunately! I've bumped the internal conversation on your behalf in order to hopefully get the issue triaged as soon as possible. The workaround described here should be a reliable solution, though! Let me know if you have any questions about getting it set up.

Also, welcome to the community!

Jay_Caston · February 25, 2025, 3:20pm

Each time I attempt to connect via Oauth with the scope crm.objects.companies.read, I get the following error on the Hubspot side during Oauth setup:

"Couldn't complete the connection Authorization failed because there is a mismatch between the scopes in the install URL and the app's configured scopes. Please contact the app developer".

In the API response, I get more info:

This app hasn't been granted all required scopes to make this call. Read more about required scopes here: HubSpot Developer Documentation. One or more of the following scopes are required: crm.schemas.companies.read, crm.objects.companies.read.

I tried adding both scopes and each one individually and kept getting the same error.

I don't get this error when I configure a Retool resource to integrate with Hubspot via Oauth with the scope crm.objects.contacts.read, but I want to pipe Company data into my Retool environment as read only, not Contacts.

Darren · March 13, 2025, 1:02am

Welcome to the community, @Jay_Caston!

This definitely sounds like the same issue that @henrymeiklejohn initially described above. Unfortunately, the underlying cause hasn't yet been addressed and the best alternative is to configure a custom REST resource with OAuth. You can find more info about this workaround at the top of the thread.

Don't hesitate to ask any questions! In the meantime, I'll reach out internally to get a status update.